Lucene search

K
oraclelinuxOracleLinuxELSA-2020-4682
HistoryNov 10, 2020 - 12:00 a.m.

grafana security, bug fix, and enhancement update

2020-11-1000:00:00
linux.oracle.com
26

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

[6.7.4-3]

  • apply patch for CVE-2020-13430 also to sources, not only to compiled webpack
    [6.7.4-2]
  • security fix for CVE-2020-13430
    [6.7.4-1]
  • update to 6.7.4 tagged upstream community sources, see CHANGELOG
  • security fix for CVE-2020-13379
    [6.7.3-1]
  • update to 6.7.3 tagged upstream community sources, see CHANGELOG
  • add scripts to list Go dependencies and bundled npmjs dependencies
  • set Grafana version in Grafana UI and grafana-cli --version
  • declare README.md as documentation of datasource plugins
  • create grafana.db on first installation (fixes RH BZ #1805472)
  • change permissions of /var/lib/grafana to 750 (CVE-2020-12458)
  • change permissions of /var/lib/grafana/grafana.db to 640 and
    user/group grafana:grafana (CVE-2020-12458)
  • change permissions of grafana.ini and ldap.toml to 640 (CVE-2020-12459)
    [6.6.2-1]
  • added patch0 to set the version string correctly
  • removed patch 004-xerrors.patch, its now upstream
  • added several patches for golang vendored vrs build dep differences
  • added patch to move grafana-cli binary to libexec dir
  • update to 6.6.2 tagged upstream community sources, see CHANGELOG

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P